Initial commit: Kinship Directory application

README.md

@@ -0,0 +1,50 @@
+# Kinship Directory
+
+A private, multi-tenant community directory built with Next.js, Node.js, Tailwind CSS, and MongoDB.
+
+## Features
+
+- Organization-level tenant isolation on every directory and image query
+- Globally unique account email, limiting each person to one organization
+- Family-level write authorization, including for administrators
+- Parent/adult and under-18 child profiles
+- Family and individual photo uploads stored in MongoDB
+- Admin-controlled organization name, logo, app icon, colors, and typography
+- Invite-code member registration
+- Responsive, installable Progressive Web App
+
+## Run with Docker
+
+Docker is the quickest option because it starts both the web application and MongoDB.
+
+```bash
+AUTH_SECRET="$(openssl rand -hex 32)" docker compose up --build
+```
+
+Open [http://localhost:3000](http://localhost:3000), choose **Create your directory**, and register the first organization administrator.
+
+## Run with Node.js
+
+Requirements: Node.js 22+, Yarn 1.22.22, and MongoDB 7+.
+
+```bash
+cp .env.example .env.local
+yarn install
+yarn dev
+```
+
+Set a random `AUTH_SECRET` of at least 32 characters in `.env.local` before deployment.
+
+## Install on iPhone
+
+1. Open the deployed HTTPS site in Safari and sign in.
+2. Tap **Share**.
+3. Tap **Add to Home Screen**.
+
+The uploaded admin app icon is used for the favicon, PWA manifest, and iPhone home-screen icon. Use a square 512 x 512 PNG for best results.
+
+## Security model
+
+Account emails are normalized to lowercase and protected by a global unique MongoDB index. Directory reads always include the session organization ID. Family updates do not accept a family ID from the browser; they derive it from the signed, HTTP-only session cookie and require both family and organization IDs to match. Branding endpoints require the organization admin role. Mutating requests validate their origin, and uploaded files are size- and MIME-restricted.
+
+For production, terminate TLS at a reverse proxy, back up the MongoDB volume, and rotate `AUTH_SECRET` using your hosting provider's secret manager.